Privilege Escalation Vulnerability in Search Operator from Red Hat
CVE-2026-70496
9.9CRITICAL
Key Information:
What is CVE-2026-70496?
A vulnerability exists within the search-v2-operator, where its ClusterRole grants it permissions equivalent to a cluster administrator. These excessive privileges allow the operator to impersonate other entities, modify RBAC configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This can lead to unauthorized privilege escalation, undermining the security model of the cluster and potentially exposing sensitive resources.
Affected Version(s)
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787688827
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787682112
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787682033